All shooter games on roblox will suffer from some exploits because the mouse position can be spoofed easily since their is no way to validate it on the server, since it relies 100% on user input.
You’re making it sound like it’s impossible to confirm where the client was looking when they shot their bullet (which is very easy to do).
Like I said, yes you’re still relying on the client to send their mouse position over, but that doesn’t mean you can’t confirm that they did actually point there or look that way (at least on x,z).
Yes for fps games, what about third person shooters? Also, that validation would be terrible for laggy players who request will come later than expected, hence they may be no longer facing that direction. That is why imo server side hit detection is not that much more secure than client side hit detection. If it is so effective then explain to me why most. if not all, popular fps games use client side hit detection? Since your saying doing it all the server will stop 100% of exploits. The best thing to do would be to do a mix of server side and client side hit detection/
I’d like to address a few things and stop replying since I know this will never end.
No, Raycasting on the server doesn’t stop all exploiters, never said that, to clarify what I said as you’ve clearly misunderstood raycasting on the server is more secure than raycasting on the client because there aren’t a lot of attack vectors.
Why don’t fps games do it? Quite simple, if you refer to my posts above I mentioned why:
“Though I still prefer doing the hit detection on the client and validating on the server as it’s much more user-friendly and will enhance gameplay experience by much more.”
Your opinion, I see that I’ll never be able to change it, perhaps once you read more maybe you’ll notice a difference but for now I won’t be arguing since I don’t see a point in proving to you something that’s been proven multiple times.
Take CS:GO for example, how does silent aim work there (silent aim is moving the projectile towards your target, not your cursor), on the client they’re looking where ever they want, but the other clients they snap to the person they’re targeting.
How come valve is able to achieve such results where cheat developers have to mimic a cheat because they’re unable to genuinely do it?
Simple, they use server hit detection, if they used client hit detection would it be much better? Doubt.
Again, anything the client can give to the server is easily exploitable, but that doesn’t render the server just as bad as the client when it comes to sensitive things.
Please do more research in the future before education other persons. CS:GO uses lag compensation on the server to help with latency issues. Such a system on roblox would not work because the server will still have to rely on the client to get the ping from a remote event, there is no other way to get the ping on the server, which is needed for the aforementioned system, hence that can still be spoofed. I will end the conversation here because I do not want to clutter the topic, but please I implore you to do more research before attempting to teach other persons or you will end up spreading misinformation. Goodbye 
So computing the paths beforehand? But my bullets bounce off at random speed when hit on the wall, I would have to send these beforehand, but the bounce randomnes speed depends on the velocity of the ball at that moment, how would I calculate something in the future?
That’s just getting overcomplicated now, if it’s fully RNG I don’t think you’d be able to mimic the projectile on the server, you’d be better off raycasting on the client and validating on the server, but that’s also another issue…
That means the other clients would have to wait for the origin to send them the selected RNG angle before continuing to visualize the projectile.
I think you should do a set of rules rather than completely random for better gameplay.
For example, the ball was moving at speed x and it hit angle y while it was looking at angle c, you’d use those to compute where the projectile would go next.
Oh ok, the current system I have makes the bullet on the server so it automaitcally replicates the movement to the client. I just make a fake bullet on the client delete it when the server bullet is made. I kinda want to have it all random , do you think the current system I have is good enough, I mean it doesn’t delay when I test it, I never tested it with more then 4 players though.
A server is a machine (that is far worse than the client’s machine), it may be a bit harsh/hard on it to be also calculating the physics and hit detection for the projectile while 40 others are calculated as well.
Alright so i’ll just use this method, for the guns which have linear/paraoblic paths. So what your saying is simulate the bullet on the client, when the client bullet is hit destory the physical bullet.
On the server when the client makes a bullet, tell all the clients to simulate the bullet, except the shooter. On the server just raycast to the next point in the path continuisly until hit, if the client visual projectile is hit from the clients raycast, then the client sends the hit position using to the server.
The server then sees if the hit position is similar to the next point in the path (if the bullet on the server is not hit yet, if it is then just disregard the client call since damage has been apllied). If the point is similar then the server raycasts to the client point and see if there is a person, if there is then damage the person.
But now aren’t we performing operations on the server on the client, except the server doesn’t render a part so it’s doing less. But aren’t the server and the client now raycasting, won’t this cause some lag on the server with a lot of projectiles? However I do realise the server is doing less now because the server is just raycasting and doesn;t actually have a physical bullet part.
You can just check if the hit point is between the start and target point. I don’t really see the point of server raycasting at the same time as the client since latency will throw off the calculations anyway.This is how i handle moving projectiles on the server for a project i’m working on with linear bullets:
- When the clients fires a bullet i save the time it started so I can validate that the time it took to detect the hit.
- When the client detects a hit I send over the hit point and the instance.
- I check if the timing is correct based on the expected speed of the projectile with some tolerance for laggy players, if it is not in the tolerated range then it waits on the server until the correct amount of time has elapsed before validating the hit.
Sanity checks:
- If the Hit’s position is within a particular range of the Hit point.
- If the Hit point is between the start and target point.
- I cast a ray from the start point to the hit point to see if anything is blocking the bullet.
1 Like
I don’t think you can send instances, from the client to the server. If you mean by player names I can’t do that either, my game has npcs and players.
You can send instances from the client to the server, they just need to be visible to the server and client, when you send instances over remotes it passes a reference to them.
My path’s include projectile motion this is why I can’t cast a direct ray, considering my projectiles are slow, this is why I cast a ray to the next point in the path every time, like fastcast. I can’t really implement that sanity check, since a player might block the path later on.
Could you explain how this would work would I just use magntude?
You can but it most likely won’t well on players with latency because the it may take some time for the event to get fired on the server, and yes you should use magnitude. My projectiles also travel at a certain speed, you would implement that check when the bullets hits the player and the projectile would have stopped moving?
Oh ok, I didn’t understand what you were trying to say so i couldn’t respond.Are you asking me a question or telling me something.
But right now with my method raycasting on the server for hitdetection and raycasting on the client for visuals allows more then 360 bullets per second.
He meants with projectiles with a higher size. Since raycasts only are 1 stud what if the projectile hit’s itself on the side the hit won’t register that’s what he asking. For that roblox could implement boxcasting, or you could cast rays on the edge of the projectile and the middle, but now your tripling your game by 3 times as more rays.